@@ -131,9 +131,12 @@ async function readViewerAccounts<T>(
131131 // The member Integrations page's rule, less what the use case established before running this.
132132 if ( ! memberScoped || ! canConnectSearchIntegrations ( config ) )
133133 throw new OrchestrationError ( 'forbidden' , 'Integrations are not available to you here' )
134- const [ accounts , owned ] = await Promise . all ( [
134+ // The boundary the assistant's direct tools answer to, which a widget must not sidestep. Read
135+ // fresh on each widget read, so a revoked approval or a tightened policy applies on the next one.
136+ const [ accounts , owned , isProviderContentReadable ] = await Promise . all ( [
135137 listViewerOrganizationAccounts ( { organizationId, userId } ) ,
136138 getOwnOrganizationManagedOAuthCredentials ( { organizationId, userId } ) ,
139+ loadAssistantProviderAccess ( organizationId ) ,
137140 ] )
138141 const candidates = accounts
139142 . flatMap ( ( account ) => {
@@ -144,9 +147,6 @@ async function readViewerAccounts<T>(
144147 . sort ( ( left , right ) => compareStrings ( left . credentialId , right . credentialId ) )
145148 if ( candidates . length === 0 ) return { accounts : [ ] , rows : [ ] }
146149 const ownedIds = new Set ( owned . map ( ( credential ) => credential . id ) )
147- // The boundary the assistant's direct tools answer to, which a widget must not sidestep. Read
148- // fresh on each widget read, so a revoked approval or a tightened policy applies on the next one.
149- const isProviderContentReadable = await loadAssistantProviderAccess ( organizationId )
150150 const readable = new Map (
151151 [ ...new Set ( candidates . map ( ( candidate ) => candidate . providerId ) ) ] . map ( ( providerId ) => [
152152 providerId ,
0 commit comments